AWS ACM Private CA support

[ryan-lane]

This change adds support for using ACM Private CA to provide an authenticated shim for issuing certificates for clients. Four endpoints are included, GET /v1/certificates/<ca>/<cn>, POST /v1/certificates/<ca>, GET /v1/cas and GET /v1/cas/<ca>. The GET certificate endpoint takes a certificate authority name (ca), and a common name argument (cn), generates a private key, CSR, and certificate for the given cn and returns a certificate, private_key and certificate_chain. The POST certificate endpoint takes a <ca> argument and a csr in the data body, and returns a certificate, and certificate chain issued for the CSR. Both endpoints accept a san argument (a URL param for GET, and a key/value in the POST body), which can be added as an extension. Both endpoints also accept a validity argument, which specify the number of days the certificate will be valid for. There's a setting to limit the max validity. The GET cas endpoint lists all configured CAs, and returns a certificate, certificate chain and a dictionary of tags for each CA. The GET ca endpoint returns certificate, certificate chain and a dictionary of tags for the specified ca.

This implementation support multiple CAs, defined in the ACM_PRIVATE_CAS setting, which is a comma delimited list of friendly names for the CAs. Settings for each CA are pulled from environment variables, postfixed with the friendly CA name, in all uppercase. e.g. ACM_PRIVATE_CAS='testca'; ACM_PRIVATE_CA_ARN_TESTCA='arn:...'

This implementation is just a pass-through, so each call will result in a certificate being generated, even if it's for the same CN with the same validity period. The idempotency token used in the ACM call is only effective for avoiding re-issuing certs within a short-period of time for the exact same CSR.

A simple cost-savings cache is included for the GET /v1/certificates/<ca>/<cn> endpoint, which will cache the csr/key/certificate in-memory, per-process. Locking is used between threads in the process to ensure that if a thread is issuing a certificate, other threads attempting to issue the same certificate will wait until the initial certificate issued, then will return the certificate from the cache.

[skiptomyliu]

Looks good, just a few minor comments.

[skiptomyliu]

Don't wanna block. Minor follow up changes we can make later.